Technical · Course T3Lesson 1 of 4
Apple MDM foundations
7 min read- Explain what APNs, ABM, and supervision each contribute
- Navigate the four tabs of WeGuard's Apple settings
- Know the renewal cadence that keeps Apple fleets alive
Three Apple concepts do all the load-bearing work. Learn them once and every Apple conversation with a customer gets easier.
The trust chain
APNs — the communication channel. WeGuard talks to Apple devices exclusively through the Apple Push Notification Service. Each tenant uploads an APNs certificate; it's valid for one year and must be renewed on time. An expired APNs certificate is the classic silent failure: every device stops responding at once, and the fix is renewal, not re-enrollment.
ABM — the ownership record. Apple Business Manager (business.apple.com) is where the customer's purchased devices live. Devices bought from Apple or authorized resellers appear in ABM and can be assigned to an MDM server. ABM also holds Apps and Books (volume app licensing).
Supervision — the management depth. Devices enrolled automatically through ABM come up supervised: the strongest restriction set, and the management profile can't be removed by the user. Manually enrolled devices are unsupervised — managed, but with a user-removable profile and a thinner restriction set. Corporate fleet = supervised, BYOD = unsupervised. That single distinction drives most Apple scoping conversations.
The four Apple surfaces in WeGuard
Everything Apple lives at Settings → Apple, in four tabs:
| Tab | What it holds |
|---|---|
| APNS | The push certificate — status, topic, Apple ID, expiry |
| DEP | The automated-enrollment token and device sync (next lesson) |
| DEP Setup | Setup Assistant customization — enabled once DEP is enrolled |
| Apps and Books | The volume-purchasing token and app licenses |
The policy set
Under Settings → Device Provisioning, the Apple policy types map to hardware and supervision state: iPhone & iPad (manual/unsupervised), iPhone & iPad Supervised, Mac Supervised, Apple TV Supervised, and Shared iPad Supervised for multi-user iPad deployments. Automated enrollment picks up the supervised policies.
The renewal calendar
Two clocks run per tenant: the APNs certificate (1 year) and the ABM server token (1 year, next lesson). Partners who put both dates in the customer's calendar at handover never get the "everything stopped working" call.